Malware Analysis Report

2025-05-28 17:26

Sample ID 230113-1kwt5she9t
Target file.exe
SHA256 d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6
Tags
purecrypter redline 1 downloader infostealer loader persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

purecrypter redline 1 downloader infostealer loader persistence spyware stealer

RedLine

PureCrypter

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-13 21:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-13 21:43

Reported

2023-01-13 21:45

Platform

win7-20221111-en

Max time kernel

155s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

PureCrypter

loader downloader purecrypter

RedLine

infostealer redline

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 872 set thread context of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 328 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 328 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 328 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 328 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 872 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 872 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 872 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 872 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 buffetdetalhes.com udp
N/A 188.114.97.0:443 buffetdetalhes.com tcp
N/A 45.142.214.214:20301 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 b0c7de14111c40f664432150255e9f86
SHA1 c54bdb6dc8821d820aad092dfd591fd9ec8ecf49
SHA256 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115
SHA512 fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

memory/872-54-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 b0c7de14111c40f664432150255e9f86
SHA1 c54bdb6dc8821d820aad092dfd591fd9ec8ecf49
SHA256 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115
SHA512 fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

memory/872-57-0x0000000000250000-0x0000000000274000-memory.dmp

memory/872-58-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

memory/872-59-0x0000000005B40000-0x0000000005C14000-memory.dmp

memory/872-60-0x0000000004D30000-0x0000000004D7A000-memory.dmp

memory/872-61-0x0000000005090000-0x0000000005122000-memory.dmp

memory/1852-62-0x0000000000000000-mapping.dmp

memory/1852-64-0x000000006DA20000-0x000000006DFCB000-memory.dmp

memory/1852-65-0x000000006DA20000-0x000000006DFCB000-memory.dmp

memory/1852-66-0x000000006DA20000-0x000000006DFCB000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 b0c7de14111c40f664432150255e9f86
SHA1 c54bdb6dc8821d820aad092dfd591fd9ec8ecf49
SHA256 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115
SHA512 fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

memory/1676-68-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1676-71-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1676-73-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1676-69-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1676-75-0x000000000041B5CA-mapping.dmp

memory/1676-74-0x0000000000400000-0x0000000000432000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 b0c7de14111c40f664432150255e9f86
SHA1 c54bdb6dc8821d820aad092dfd591fd9ec8ecf49
SHA256 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115
SHA512 fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

memory/1676-78-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1676-80-0x0000000000400000-0x0000000000432000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-13 21:43

Reported

2023-01-13 21:45

Platform

win10v2004-20221111-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

PureCrypter

loader downloader purecrypter

RedLine

infostealer redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1904 set thread context of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1676 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1676 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1676 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
PID 1904 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Network

Country Destination Domain Proto
N/A 93.184.221.240:80 tcp
N/A 104.80.225.205:443 tcp
N/A 8.8.8.8:53 buffetdetalhes.com udp
N/A 188.114.97.0:443 buffetdetalhes.com tcp
N/A 20.189.173.12:443 tcp
N/A 87.248.202.1:80 tcp
N/A 87.248.202.1:80 tcp
N/A 87.248.202.1:80 tcp

Files

memory/1904-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 b0c7de14111c40f664432150255e9f86
SHA1 c54bdb6dc8821d820aad092dfd591fd9ec8ecf49
SHA256 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115
SHA512 fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 b0c7de14111c40f664432150255e9f86
SHA1 c54bdb6dc8821d820aad092dfd591fd9ec8ecf49
SHA256 09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115
SHA512 fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

memory/1904-135-0x0000000000C30000-0x0000000000C54000-memory.dmp

memory/1904-136-0x0000000005C60000-0x0000000006204000-memory.dmp

memory/1904-137-0x00000000055F0000-0x0000000005682000-memory.dmp

memory/1904-138-0x00000000057B0000-0x00000000057BA000-memory.dmp

memory/1904-139-0x0000000006C80000-0x0000000006CD0000-memory.dmp

memory/1904-140-0x0000000006EF0000-0x0000000006FA2000-memory.dmp

memory/1904-141-0x00000000072E0000-0x0000000007302000-memory.dmp

memory/2496-142-0x0000000000000000-mapping.dmp

memory/2496-143-0x0000000002AF0000-0x0000000002B26000-memory.dmp

memory/2496-144-0x0000000005350000-0x0000000005978000-memory.dmp

memory/2496-145-0x00000000059F0000-0x0000000005A56000-memory.dmp

memory/2496-146-0x0000000005A60000-0x0000000005AC6000-memory.dmp

memory/2496-147-0x00000000060C0000-0x00000000060DE000-memory.dmp

memory/2496-148-0x0000000007700000-0x0000000007D7A000-memory.dmp

memory/2496-149-0x00000000065C0000-0x00000000065DA000-memory.dmp

memory/3572-150-0x0000000000000000-mapping.dmp

memory/4380-152-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 f0d621207b3805f4101ee9eae0f02a1c
SHA1 f9eb653326a93e608e42800cc874a897f5a95ffa
SHA256 613f6ccc32fa32590acf90815597439cded663f951a87891d54d4078b7e37f18
SHA512 b2910373c9fb6c36064bd4461eeb1ab557223c1dd572d8c712a4576074422c9e871e98941cfe100d40eae57e38c3e43a37ffd4a6a11021eabe9485d8ee3c57a1

memory/4380-153-0x0000000000400000-0x0000000000432000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

MD5 04a4105ad93a2ea565e46da45793ac6a
SHA1 913926a0c985c7777bbd0e751e9fe3ed2208a0b4
SHA256 49e99ba25608615607d01de6651bc72d5daaf875150aa053b006e83383f4993e
SHA512 3cc837718882849f8f0a568f37917cde7a78b3d443cc47c7c52bcbacd012fd3b919cfca7b89eb3f425ae4936c852870f01618ba1baa1edd9717df83fb9683282

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ifmedianov.exe.log

MD5 2e49a0dc2cc777cf418322c4466c896e
SHA1 d1c48311da63a8124b58ca948b0d64409e927d2d
SHA256 b6e3216891c905bc01dfa776fb8f50aadd5b51b997551eb32ad5e21a53574041
SHA512 b03923994a5b5b0c8ea0905a19a820eda810ded3687e965ee280641eb6b9dd8bf36ce3984bb04712199fcaffc28cacbbadcc872e12b2bda7f491091aa656156a